CVE-2024-58079

A flaw was found in the Linux kernel's uvcvideo driver. A local user with a device containing a GPIO (General Purpose Input/Output) unit could trigger a system crash by unbinding the driver from the USB interface. This occurs because cleanup functions are not properly called, leading to an Interrupt Request (IRQ) attempting to access freed memory. This vulnerability results in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the uvcvideo kernel module from loading. This can be achieved by creating a modprobe configuration file.

Create a file named /etc/modprobe.d/uvcvideo.conf with the following content:

install uvcvideo /bin/true

After creating the file, a system reboot is required for the changes to take effect. Alternatively, if the module is currently loaded, it can be unloaded using rmmod uvcvideo (if not in use) and then reloaded, or the system can be rebooted. Disabling this module may affect the functionality of USB video devices.